While analyzing new malware samples we stumbled over a sample which contains a digital Avira signature. Something we need to check! Viewing the properties of the digital signature, Microsoft Windows shows a note “A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider”. Don’t misunderstand that message – it means that this certificate is not created by Avira GmbH and therefore it’s not a stolen certificate. Stuxnet gained a lot of attention by the media because it contained a valid digital signature from “Realtek Semiconductor” which was obviously stolen by the malware authors.

The certificate used in this malware sample is issued to Avira GmbH and is valid from 2011-02-10 till 2039-31-12.

There is some more information available in the digital certificate:

The malware itself is nothing new. It’s a member of the well known Zbot/ZeuS malware family which is spammed via Email. The Trojan doesn’t show new behavior of the Zbot/ZeuS authors. Upon execution it is creating a copy of itself and is deleting the original executed file; also it adds a runkey to the Windows registry in order to get started after a reboot. After this the Trojan tries to connect to the C&C Server “**ciq.net” to receive more information about targets to spy upon and where to send the information to.

Avira is already protecting customers since VDF Version which detects this piece of malware as TR/Kazy.12258 starting with version 7.11.03.117.

Thomas Wegele
Virus Researcher

• Fake Certificate in Malware – with Message
  The malware authors every now and then send us virus researchers some messages. For example in the compiled binary itself, or as debug output. Now we found a Zbot Trojan variant which tries to evade d...
• Avira Standalone Malware Scanner – De-Cleaner
  Our developers now released a new standalone malware scanner, for the initiative of the German BSI together with the eco association called Anti-Botnet Beratungszentrum – a project to fight back...
• Bredolab Malware spammed via fake Facebook Mails
  The popularity of the social network Facebook is abused again to spread Malware via Email. The spam mails arrive with the subject “Facebook password has been changed. ID” and contain a ZI...
• Fake Adobe FlashPlayer Update nov.2010 delivers malware
  A website labelled ‘Porn TV’ acts as a malware distribution platform: freev.info When clicking on any video link, a very convincing screen pops up: Downloading the update actually downloa...
• Fake Live Webcam site distributes malware
  A pink colored webpage is set as a trap to attract men looking to chat with young attractive women. Clicking anywhere of the page will trigger a file download for a “Flash Player”. www.{ob...
• Fake Apple iTunes Receipts Used as Malware Tool (PC Magazine)
  PC Magazine - PandaLabs said Monday that the company has discovered fake iTunes receipts that have begun to be sent to users in an attempt to steal personal details. View full post on Yahoo! News: ...
• Week in Microsoft: here mousey mousey, best fake malware ever
  Microsoft unveils shape-shifting Arc Touch Mouse: Microsoft has officially announced the $70 the Arc Touch Mouse. The device is available for presale now, starts shipping in Dec...
• New malware detects browser, shows fake malware warning page
  Microsoft is warning about a new piece of malware, Rogue:MSIL/Zeven, that auto-detects a user's browser and then imitates the relevant malware warning pages from Internet Explor...
• Zeus Malware Used Pilfered Digital Certificate (PC World)
  PC World - Researchers at Trend Micro have found that a widespread piece of malware used a digital certificate from a competing security company's product in an attempt to look legitimate. View ful...
• Zeus malware used pilfered digital certificate
  Researchers at Trend Micro have found that a widespread piece of malware used a digital certificate from a competing security company's product in an attempt to look legitimate. View full post on C...